From 06be298c927182492febe9c6be9ab523583be611 Mon Sep 17 00:00:00 2001 From: GitHub Date: Thu, 9 Jul 2026 22:12:20 +0800 Subject: [PATCH] =?UTF-8?q?ci(publish):=20=E6=9A=82=E6=97=B6=E5=85=B3?= =?UTF-8?q?=E9=97=AD=20attestations=20=E8=A7=84=E9=81=BF=20OIDC=20503=20?= =?UTF-8?q?=E6=95=85=E9=9A=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub OIDC → sigstore 服务连续 503 overflow（v1.20.2 两次 publish 失败）， 非配置问题（v1.20.1 能发成功证明 trusted publishing 配置正确）。 attestations 是可选签名，关闭后上传正常进行；待服务稳定后改回 true。 --- .github/workflows/publish.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b66d2f5..6dc68ab 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -40,6 +40,7 @@ jobs: - uses: pypa/gh-action-pypi-publish@release/v1 with: - # 启用 PyPI 签名认证（sigstore provenance），让用户可验证产物来源。 - # id-token: write 已在上方 permissions 配置，OIDC trusted publishing 直连。 - attestations: true + # sigstore provenance 签名认证。OIDC 服务（GitHub Actions → sigstore） + # 偶发 503 overflow 故障时会让整个 publish 失败，故暂时关闭； + # 待服务稳定后再改回 true。上传本身用 OIDC trusted publishing，无需 API token。 + attestations: false